Thread Context

This API allows the bot to get additional information about the user and where the webview was invoked.

It's useful in creating interactive group experiences and games as well to restrict any content that was intended to be shared only to a certain thread.

1. Using getContext()
2. Validating the signed_request

Using getContext()

Call this function to get the user ID, thread ID, and thread type.

MessengerExtensions.getContext('YOUR_APP_ID', 
  function success(result){
    ...
  },
  function error(result){
    ...
  }
);

Parameters

The response passed to the success callback will be a JavaScript object in the following format:

Response Format

{
  "thread_type": "GROUP",
  "tid": "1411911565550430",
  "psid": "1293479104029354",
  "signed_request": "YOUR_SIGNED_REQUEST"
}

Fields

Validating the signed_request

There are situations where you may wish to transmit the information obtained from getContext() to your backend and validate it before performing some action like a login or purchase. This allows you to ensure that the information really did come from Messenger and was not spoofed.

The signed_request is base64url encoded and signed with an HMAC version of your App Secret, based on the OAuth 2.0 spec.

You can validate it with the following 4 steps:

1. Split the signed request into two parts delimited by a '.' character (e.g. 238fsdfsd.oijdoifjsidf899)
2. Decode the first part — the encoded signature — from base64url encoding.
3. Decode the second part — the payload — from base64url encoding. This can be used on the server side if needed.
4. Hash the original payload using HMAC SHA-256 and your app secret and confirm that it is equal to the encoded signature originally passed.
5. You may also wish to validate the issued_at timestamp in the payload to ensure the recency of the request.

This can be done in any modern programming language. Below is an example in PHP:

function parse_signed_request($signed_request) {
  list($encoded_sig, $payload) = explode('.', $signed_request, 2); 

  $secret = "appsecret"; // Use your app secret here

  // Decode the data
  $sig = base64_url_decode($encoded_sig);
  $data = json_decode(base64_url_decode($payload), true);

  // Confirm the signature
  $expected_sig = hash_hmac('sha256', $payload, $secret, $raw = true);
  if ($sig !== $expected_sig) {
    error_log('Bad Signed JSON signature!');
    return null;
  }

  return $data;
}

function base64_url_decode($input) {
  return base64_decode(strtr($input, '-_', '+/'));
}

Decoding the payload will yield an object with the same information as originally returned by getContext(), but with the addition of algorithm, issued_at, and page_id fields:

{
  "psid": "1293479104029354", 
  "algorithm": "HMAC-SHA256", 
  "thread_type": "GROUP", 
  "tid": "1411911565550430", 
  "issued_at": 1491351619, 
  "page_id": 167938560376726
}